Home

Description

Better Auth is an authentication and authorization library for TypeScript. An open redirect has been found in the originCheck middleware function, which affects the following routes: /verify-email, /reset-password/:token, /delete-user/callback, /magic-link/verify, /oauth-proxy-callback. This vulnerability is fixed in 1.2.10.

PUBLISHED Reserved 2025-07-02 | Published 2025-07-07 | Updated 2025-07-07 | Assigner GitHub_M




LOW: 2.1CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

Problem types

CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

Product status

< 1.2.10
affected

References

github.com/...r-auth/security/advisories/GHSA-36rg-gfq2-3h56

cve.org (CVE-2025-53535)

nvd.nist.gov (CVE-2025-53535)

Download JSON